repository icon
limesurvey / limesurvey Project repository

The most popular FOSS online survey tool on the web.

Submit a report

FIRST INTERACTION

WITHIN5 DAYS

REVIEW

WITHIN20 DAYS

FIX

WITHIN35 DAYS

Permission vulnerability
nam-no
not applicable
Store XSS at Create Survey
lucaidau888
not applicable
Cross-site Scripting (XSS) - Stored in Create Survey(Share survey)
nam-no
not applicable
normal user can put servey to any group
ranjit-git
not applicable
privilege escalation bug to edit survey
ranjit-git
Critical
•$75
xss fix bypass of
ranjit-git
self closed
XSS in Survey menus (Menu icon type and Menu icon)
hainguyen0207
High
•$40
Store XSS in Label sets list version 6.2.11
hainguyen0207
High
•$40
Stored XSS
huu-cuong
not applicable
CSRF in Save Box Settings
hainguyen0207
Medium
•$15
Store XSS in "Add Question" function
trungg02
self closed
XSS still exists in Survey title (Version 6.2.9)
hainguyen0207
self closed
CSRF In Copy Survey
hainguyen0207
High
•$40
CSRF edit Blacklist settings( YES to NO)
hainguyen0207
High
•$40
Cross-site Scripting (XSS) - Stored in (Create Survey/Add Group)
nam-no
not applicable
Store XSS when Edit label set
hainguyen0207
High
•$40
Privilege Escalation in Survey Group
hainguyen0207
not applicable
CSRF in Reset Survery menus
hainguyen0207
High
•$40
CSRF in Export Themes function
lucaidau888
not applicable
The survey has expired but is still active
hainguyen0207
not applicable
CSRF in Export File Surveys
hainguyen0207
not applicable
Incorrect Authorization in User role
hainguyen0207
Medium
•$15
User sends email to group member, while not having general user group permission...
hainguyen0207
High
•$40
Add arbitrary users to the user group
hainguyen0207
High
•$40
Account past their expiration date are still active
hainguyen0207
High
•$40
Improper permission management
hainguyen0207
High
•$40
CSRF in User management function
trungg02
not applicable
CSRF in Export lable set function
trunggg02
not applicable
Store XSS in Survey menus (Version 6.2.9)
hainguyen0207
duplicate
High
Store XSS at Label sets list in (Version 6.2.7)
hainguyen0207
High
•$40
CSRF - User performed an unexpected sign out
hainguyen0207
not applicable
Account past their expiration date are still active
hainguyen0207
self closed
IDOR - Users can change Administrator information (User ID = 1 )
hainguyen0207
Critical
•$75
Deleted account still has the right to create, delete other accounts (delete su...
hainguyen0207
High
•$40
Store XSS in Central participant management
hainguyen0207
High
•$40
boolean-based blind SQL injection
nishaaaap
not applicable
Reflected XSS in Central participant management
hainguyen0207
not applicable
Store XSS in Survey menus
hainguyen0207
High
•$40
Store XSS in add group
hainguyen0207
duplicate
High
Store XSS at Add dummy user
hainguyen0207
not applicable
Store DOM XSS when create survey
hainguyen0207
Medium
•$15
Store XSS at Label sets list
hainguyen0207
not applicable
Stored XSS in Configuration-User Managerment
nyeooo
not applicable
LimeSurvey v5.6.34 has a reflective XSS vulnerability
hebing123
not applicable
LimeSurvey v6.2.9-230925 has a storage based XSS vulnerability caused by importM...
hebing123
Medium
•$15
Old password is accepted as new password
th3l0newolf
not applicable
Input Validation Vulnerability Leading to Denial of Service in LimeSurvey v6.3.0...
hebing123
Medium
•$15
Improper Authorization in Import Question function
trongdaong24
High
•$40
Stored XSS via user's Username
williwollo
High
•$40
Reflected XSS in LimeSurvey via userid parameter
williwollo
High
•$40
privilege escalation bug to creation survey-group with others group as parent
ranjit-git
Critical
•$105
Reflected XSS in Alert Message Widget
tuannq2299
not applicable
Stored XSS in module named "Survey" in limesurvey/limesurvey
trunggg02
not applicable
see survey title and total record without access-code
ranjit-git
not applicable
user with view permission in group can delete user from this group
ranjit-git
not applicable
user with view permission in group can add user to this group
ranjit-git
not applicable
access survey information without access-code
ranjit-git
not applicable
xss in survey title
surayp
duplicate
Medium
xss in survey Administrator email address
surayp
not applicable
xss using survey end-url
ranjit-git
duplicate
High
Stored xss using survey welcome message
ranjit-git
not applicable
Stored Open Redirect in Dashboard of Users due to improper input sanitization
thirukrishnan
not applicable
Server-Side Request Forgery using Destination URL in Box Settings displayed in D...
thirukrishnan
self closed
Stored XSS in description of theme
nduy2110
High
•$40
IDOR make attacker can see others Notification
lujiefsi
self closed
XSS Reflected via import file funtion
aqngoc
High
•$40
Stored XSS via user's Full Name
nerrorsec
High
•$40
Unauthorized access to Survey menu entries
nerrorsec
High
•$40
Reflected XSS via "importFormat" parameter
nerrorsec
High
•$40
CSRF in Question Themes function
tuannq2299
Medium
•$15
The user can put their survey in the survey groups even though this survey group...
trongdaong24
High
•$40
Able to change survey group's code that is by default unchangeable
trongdaong24
not applicable
Improper Authorization in add role function leads to privilege escalation
aqngoc
Medium
•$15
Incorrect Authorization to Stored XSS in Import User Role function
aqngoc
High
•$40
Stored XSS in Survey Group function
tuannq2299
duplicate
High
IDOR in View User Detail
tuannq2299
not applicable
Stored XSS
aqngoc
duplicate
High
Stored XSS on Survey "Notification and data function"
hiu240900
Medium
•$15
Improper Authorization in Take Ownership function
aqngoc
duplicate
High
Improper Authorization in Export role function
aqngoc
Medium
•$15
IDOR in Group members
tuannq2299
Medium
•$15
Stored XSS in label function
tuannq2299
Medium
•$15
CSRF in the delete notification function
tuannq2299
Medium
•$15
IDOR in notification function
tuannq2299
Medium
•$15
The user can export/import Role without permissions
trongdaong24
duplicate
High
Xss stored and HTML injection
nilabhrajpoot
spam
Sensitive Information leaked in Source.
nilabhrajpoot
not applicable
Stored XSS in module named "List Survey"
trunggg02
duplicate
High
Able to edit users owned by other administration users
trongdaong24
High
•$40
Stored XSS in the delete confirmation popup
aqngoc
Medium
•$15
The ability to edit groups owned by any user.
trongdaong24
Medium
•$15
Improper Authorization leads to privilege escalation
aqngoc
High
•$40
Incorrect Authorization leads to delete user
aqngoc
High
•$40
The user can delete himself
trongdaong24
Medium
•$15
Able to change username that is by default unchangeable
trongdaong24
Medium
•$15
Store XSS in Title Label
anh91
not applicable
Stored XSS in Survey Groups Function
tuannq2299
Medium
•$15
Stored XSS vulnerability found in the question editing feature.
trongdaong24
not applicable
Stored XSS vulnerability
aqngoc
Medium
•$15
Stored XSS in End page
yujitounai
Medium
•$15
Weak Server SIde controls on User Action
mohitkumar0786
spam
Possible Email HTML Injection
mrempy
not applicable
Weak Password Requirements
mrempy
informative
Medium
CSRF Leading to reset Boxes
mdakh404
Medium
•$15
CKeditor 4.20.2 in use which is vulnerable to CVE-2023-28439
popcorn94
Low
•$5
Able to change admin email and password without current password validation.
rac-fckscty
Medium
•$15
Stored XSS in survey settings
007nicky
not applicable
XSS - stored in Survey title
ch1nhpd
not applicable
Reflected XSS in LimeSurvey
peymankf
High
•$40
Stored xss while changing theme twig files
shellinjector
not applicable
Cross site scripting in adding questions
ghostbit11
not applicable
CSV Injection in CSV files generated by the backend
lujiefsi
Medium
•$15
Upload Plugin with Path Traversal to RCE + Delete all files in webroot
nguyendangtoan
not applicable
XSS @ Timer
hatlesswizard
not applicable
Stored XSS via Group Name
nerrorsec
not applicable
XSS via answer options
nerrorsec
not applicable
Stored XSS in Notification and Data Management
nerrorsec
Medium
•$18
Vulnerable javascript dependency used in adminsidepanel.js
khanhchauminh
Low
•$5
Information Exposure through Source Code
khanhchauminh
self closed
stored xss
memmedrehimzade
not applicable
Bypass IP detection lead to perform brute-force attack
nhienit2010
Medium
•$15
Stored Xss in Question field
error-2001
self closed
Multiple XSS Stored
cupc4k3
not applicable
Bootstrap-switch 3.3.2 in use which is vulnerable to XSS
popcorn94
Low
•$5
Jquery UI 1.13.1 in use which is vulnerable to CVE-2022-31160
popcorn94
Low
•$5
Host header injection leads to account take over
hunt3r0x
spam
No Rate Limit On Forgot [Password and Username] Lead to Email Boombing
sl4x0
spam
UI REDRESSING
ctflearner
spam
xss using question content
ranjit-git
not applicable
xss using survey name
ranjit-git
not applicable
stored xss
ranjit-git
Medium
•$18
reflected xss
ranjit-git
Medium
•$15
Stored Cross-Site Scripting in survey administrator name
ar6aaz
Medium
•$15
Cross-site Scripting (XSS) - Stored
0x7zed
not applicable